VULN/vuln-cve
1
0
Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-10T18:02:43Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-10 19:02:45 +01:00
parent a5631555ab
commit a5623c3bc0
160 changed files with 12040 additions and 663 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/2024/9xxx/CVE-2024-9355.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2024-09-30T17:07:30.833Z",
"datePublished": "2024-10-01T18:17:29.420Z",
"dateUpdated": "2026-11-05T12:15:45.984Z"
"dateUpdated": "2026-11-10T17:49:15.914Z"
},
"containers": {
"cna": {
@@ -1231,7 +1231,7 @@
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-aws-efs-csi-driver-container-rhel9",
"packageName": "openshift4/ose-aws-efs-csi-driver-container-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
@@ -1241,7 +1241,7 @@
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-gcp-filestore-csi-driver-rhel8",
"packageName": "openshift4/ose-gcp-filestore-csi-driver-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
@@ -1839,7 +1839,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T12:15:45.984Z"
"dateUpdated": "2026-11-10T17:49:15.914Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/103xxx/CVE-2026-103061.json
+5 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-10-07T13:15:01.364Z",
"datePublished": "2026-10-12T18:23:41.507Z",
"dateUpdated": "2026-10-16T17:49:42.484Z"
"dateUpdated": "2026-11-10T17:33:56.845Z"
},
"containers": {
"cna": {
@@ -76,7 +76,7 @@
"gleam_cli::fs"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:oci/gleam?repository_url=ghcr.io%2Fgleam-lang",
"packageURL": "pkg:oci/gleam?repository_url=ghcr.io%2Fgleam-lang%2Fgleam",
"product": "Gleam",
"programFiles": [
"compiler-cli/src/dependencies.rs",
@@ -288,6 +288,7 @@
}
],
"dateAssigned": "2026-10-07T22:06:26.000Z",
"datePublic": "2026-10-12T18:23:41.000Z",
"descriptions": [
{
"lang": "en",
@@ -368,7 +369,7 @@
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
@@ -378,7 +379,7 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-10-12T18:23:41.507Z"
"dateUpdated": "2026-11-10T17:33:56.845Z"
},
"references": [
{
data/2026/103xxx/CVE-2026-103674.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Checkmk",
"dateReserved": "2026-10-01T09:04:13.924Z",
"datePublished": "2026-11-06T09:06:40.803Z",
"dateUpdated": "2026-11-06T09:06:40.803Z"
"dateUpdated": "2026-11-10T17:42:41.362Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:40:30.843560Z",
"id": "CVE-2026-103674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:42:41.362Z"
}
}
]
}
}
data/2026/103xxx/CVE-2026-103682.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Checkmk",
"dateReserved": "2026-10-01T09:19:30.801Z",
"datePublished": "2026-11-06T09:07:55.856Z",
"dateUpdated": "2026-11-06T09:07:55.856Z"
"dateUpdated": "2026-11-10T17:43:47.092Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:43:31.140722Z",
"id": "CVE-2026-103682",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:43:47.092Z"
}
}
]
}
}
data/2026/105xxx/CVE-2026-105425.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-05T12:48:38.617Z",
"datePublished": "2026-11-10T15:43:00.759Z",
"dateUpdated": "2026-11-10T15:43:00.759Z"
"dateUpdated": "2026-11-10T17:26:36.642Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T15:43:00.759Z"
"dateUpdated": "2026-11-10T17:26:36.642Z"
},
"problemTypes": [
{
@@ -89,12 +89,12 @@
"descriptions": [
{
"lang": "en",
"value": "OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.",
"value": "OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution."
"value": "OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution."
}
]
}
data/2026/105xxx/CVE-2026-105426.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-05T12:48:39.997Z",
"datePublished": "2026-11-10T15:54:24.149Z",
"dateUpdated": "2026-11-10T16:38:45.261Z"
"dateUpdated": "2026-11-10T17:28:32.954Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T15:54:24.149Z"
"dateUpdated": "2026-11-10T17:28:32.954Z"
},
"problemTypes": [
{
@@ -67,12 +67,12 @@
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.",
"value": "Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root."
"value": "Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root."
}
]
}
data/2026/105xxx/CVE-2026-105427.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-05T12:48:41.073Z",
"datePublished": "2026-11-10T15:57:39.124Z",
"dateUpdated": "2026-11-10T15:57:39.124Z"
"dateUpdated": "2026-11-10T17:29:09.471Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T15:57:39.124Z"
"dateUpdated": "2026-11-10T17:29:09.471Z"
},
"problemTypes": [
{
@@ -67,12 +67,12 @@
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.",
"value": "Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service. "
"value": "Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service. "
}
]
}
data/2026/105xxx/CVE-2026-105669.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-05T16:57:22.487Z",
"datePublished": "2026-11-10T15:45:42.277Z",
"dateUpdated": "2026-11-10T15:45:42.277Z"
"dateUpdated": "2026-11-10T17:32:18.042Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T15:45:42.277Z"
"dateUpdated": "2026-11-10T17:32:18.042Z"
},
"problemTypes": [
{
@@ -67,12 +67,12 @@
"descriptions": [
{
"lang": "en",
"value": "Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.",
"value": "Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries. "
"value": "Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries. "
}
]
}
data/2026/107xxx/CVE-2026-107404.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-07T21:35:39.743Z",
"datePublished": "2026-11-10T15:59:51.214Z",
"dateUpdated": "2026-11-10T15:59:51.214Z"
"dateUpdated": "2026-11-10T17:29:46.336Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T15:59:51.214Z"
"dateUpdated": "2026-11-10T17:29:46.336Z"
},
"problemTypes": [
{
@@ -67,12 +67,12 @@
"descriptions": [
{
"lang": "en",
"value": "Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.",
"value": "Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk. "
"value": "Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk. "
}
]
}
data/2026/107xxx/CVE-2026-107405.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-10-07T21:35:40.271Z",
"datePublished": "2026-11-10T16:02:19.948Z",
"dateUpdated": "2026-11-10T16:02:19.948Z"
"dateUpdated": "2026-11-10T17:30:20.493Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T16:02:19.948Z"
"dateUpdated": "2026-11-10T17:30:20.493Z"
},
"problemTypes": [
{
@@ -67,12 +67,12 @@
"descriptions": [
{
"lang": "en",
"value": "An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of service.",
"value": "An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of service.  "
"value": "An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.  "
}
]
}
data/2026/107xxx/CVE-2026-107474.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-08T07:54:15.560Z",
"datePublished": "2026-11-09T09:19:48.955Z",
"dateUpdated": "2026-11-09T13:04:27.940Z"
"dateUpdated": "2026-11-10T17:22:24.145Z"
},
"containers": {
"cna": {
@@ -102,7 +102,7 @@
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-09T13:04:27.940Z"
"dateUpdated": "2026-11-10T17:22:24.145Z"
},
"references": [
{
data/2026/108xxx/CVE-2026-108018.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "HCL",
"dateReserved": "2026-10-09T09:26:54.337Z",
"datePublished": "2026-11-06T08:27:09.873Z",
"dateUpdated": "2026-11-06T08:27:09.873Z"
"dateUpdated": "2026-11-10T17:35:06.894Z"
},
"containers": {
"cna": {
@@ -93,6 +93,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:33:57.046825Z",
"id": "CVE-2026-108018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:35:06.894Z"
}
}
]
}
}
data/2026/111xxx/CVE-2026-111454.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-16T04:01:37.703Z",
"datePublished": "2026-11-09T09:07:30.929Z",
"dateUpdated": "2026-11-09T13:04:53.228Z"
"dateUpdated": "2026-11-10T17:22:56.784Z"
},
"containers": {
"cna": {
@@ -102,7 +102,7 @@
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-09T13:04:53.228Z"
"dateUpdated": "2026-11-10T17:22:56.784Z"
},
"references": [
{
data/2026/111xxx/CVE-2026-111494.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "INCIBE",
"dateReserved": "2026-10-16T09:54:33.846Z",
"datePublished": "2026-11-05T21:58:02.432Z",
"dateUpdated": "2026-11-05T21:58:02.432Z"
"dateUpdated": "2026-11-10T17:02:02.198Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:01:46.390464Z",
"id": "CVE-2026-111494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:02:02.198Z"
}
}
]
}
}
data/2026/111xxx/CVE-2026-111729.json
+118
View File
@@ -0,0 +1,118 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-111729",
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"state": "PUBLISHED",
"assignerShortName": "eclipse",
"dateReserved": "2026-10-16T15:10:09.577Z",
"datePublished": "2026-11-10T17:09:16.247Z",
"dateUpdated": "2026-11-10T17:09:16.247Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse",
"dateUpdated": "2026-11-10T17:09:16.247Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-22",
"description": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Eclipse Foundation",
"product": "Eclipse Kura",
"versions": [
{
"status": "affected",
"version": "0.7.0",
"lessThanOrEqual": "5.6.2",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Kura versions <= 5.6.2, the \"Command\" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is accepted. The handler then calls `parent.mkdirs()` and `new FileOutputStream(newFile)`, creating directories and writing attacker-controlled bytes outside the intended extraction root.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with `rest.command` permission.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Kura versions &lt;= 5.6.2, the \"Command\" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is accepted. The handler then calls `parent.mkdirs()` and `new FileOutputStream(newFile)`, creating directories and writing attacker-controlled bytes outside the intended extraction root.</p><p>The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with `rest.command` permission.</p>"
}
]
}
],
"references": [
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/958"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/428"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Eclipse Foundation Security Team",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/112xxx/CVE-2026-112185.json
+131
View File
@@ -0,0 +1,131 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-112185",
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"state": "PUBLISHED",
"assignerShortName": "eclipse",
"dateReserved": "2026-10-19T09:21:00.410Z",
"datePublished": "2026-11-10T16:58:30.765Z",
"dateUpdated": "2026-11-10T16:58:30.765Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse",
"dateUpdated": "2026-11-10T16:58:30.765Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-863",
"description": "CWE-863",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-522",
"description": "CWE-522",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-668",
"description": "CWE-668",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Eclipse Foundation",
"product": "Eclipse Kura",
"versions": [
{
"status": "affected",
"version": "5.1.0",
"lessThanOrEqual": "5.6.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/eclipse-kura/kura/security/advisories/GHSA-gqr7-j252-qwqx"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/430"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.6,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/112xxx/CVE-2026-112186.json
+131
View File
@@ -0,0 +1,131 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-112186",
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"state": "PUBLISHED",
"assignerShortName": "eclipse",
"dateReserved": "2026-10-19T09:21:22.208Z",
"datePublished": "2026-11-10T17:02:46.279Z",
"dateUpdated": "2026-11-10T17:02:46.279Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse",
"dateUpdated": "2026-11-10T17:02:46.279Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-696",
"description": "CWE-696",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-674",
"description": "CWE-674",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-770",
"description": "CWE-770",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Eclipse Foundation",
"product": "Eclipse Kura",
"versions": [
{
"status": "affected",
"version": "5.4.0",
"lessThanOrEqual": "5.6.2",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/429"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/115xxx/CVE-2026-115791.json
+48 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PSF",
"dateReserved": "2026-10-23T14:12:50.150Z",
"datePublished": "2026-11-10T16:33:49.360Z",
"dateUpdated": "2026-11-10T16:33:49.360Z"
"dateUpdated": "2026-11-10T17:25:02.503Z"
},
"containers": {
"cna": {
@@ -136,6 +136,52 @@
"discovery": "UNKNOWN"
},
"title": "Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction"
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-829",
"lang": "en",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:24:59.223694Z",
"id": "CVE-2026-115791",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:25:02.503Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116592.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "openjs",
"dateReserved": "2026-10-26T15:14:13.192Z",
"datePublished": "2026-11-06T10:05:41.972Z",
"dateUpdated": "2026-11-06T10:05:41.972Z"
"dateUpdated": "2026-11-10T17:38:20.727Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:37:59.041677Z",
"id": "CVE-2026-116592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:38:20.727Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116630.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "openjs",
"dateReserved": "2026-10-26T17:49:18.547Z",
"datePublished": "2026-11-06T10:13:44.685Z",
"dateUpdated": "2026-11-06T10:13:44.685Z"
"dateUpdated": "2026-11-10T17:41:21.172Z"
},
"containers": {
"cna": {
@@ -135,6 +135,40 @@
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:41:05.332969Z",
"id": "CVE-2026-116630",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:41:21.172Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119446.json
+5 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-07T21:44:37.269Z",
"datePublished": "2026-11-10T10:44:15.336Z",
"dateUpdated": "2026-11-10T10:44:15.336Z"
"dateUpdated": "2026-11-10T17:11:05.623Z"
},
"containers": {
"cna": {
@@ -26,7 +26,7 @@
"'Elixir.NervesHubWeb.Router'"
],
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/user_controller.ex",
@@ -79,7 +79,7 @@
"'Elixir.NervesHubWeb.Router'"
],
"packageName": "nerves_hub",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/user_controller.ex",
@@ -219,6 +219,7 @@
}
],
"dateAssigned": "2026-11-09T22:12:23.000Z",
"datePublic": "2026-11-10T10:44:15.000Z",
"descriptions": [
{
"lang": "en",
@@ -309,7 +310,7 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-10T10:44:15.336Z"
"dateUpdated": "2026-11-10T17:11:05.623Z"
},
"references": [
{
data/2026/120xxx/CVE-2026-120212.json
+107
View File
@@ -0,0 +1,107 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120212",
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"state": "PUBLISHED",
"assignerShortName": "CPANSec",
"dateReserved": "2026-10-31T13:26:38.835Z",
"datePublished": "2026-11-10T17:42:05.207Z",
"dateUpdated": "2026-11-10T17:42:05.207Z"
},
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Web::Simple"
],
"packageName": "Web-Simple",
"packageURL": "pkg:cpan/Web-Simple",
"programFiles": [
"lib/XML/Tags.pm"
],
"programRoutines": [
{
"name": "XML::Tags::to_xml_string"
}
],
"repo": "https://github.com/p5sagit/Web-Simple",
"versions": [
{
"lessThan": "0.037",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.\n\nHTML::Tags and XML::Tags escape a plain string value by replacing only &, \", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.\n\nAn attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec",
"dateUpdated": "2026-11-10T17:42:05.207Z"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/ETHER/Web-Simple-0.037/changes"
},
{
"tags": [
"related"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5090"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Web-Simple 0.037 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output",
"workarounds": [
{
"lang": "en",
"value": "Use double-quoted attributes for values that may contain untrusted data."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
}
}
data/2026/120xxx/CVE-2026-120222.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "openjs",
"dateReserved": "2026-10-31T19:03:40.724Z",
"datePublished": "2026-11-06T10:00:50.635Z",
"dateUpdated": "2026-11-06T10:00:50.635Z"
"dateUpdated": "2026-11-10T17:46:47.844Z"
},
"containers": {
"cna": {
@@ -130,6 +130,40 @@
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:46:29.400804Z",
"id": "CVE-2026-120222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:46:47.844Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120415.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "openjs",
"dateReserved": "2026-11-02T11:55:49.802Z",
"datePublished": "2026-11-06T10:10:48.653Z",
"dateUpdated": "2026-11-06T10:10:48.653Z"
"dateUpdated": "2026-11-10T17:40:41.647Z"
},
"containers": {
"cna": {
@@ -135,6 +135,40 @@
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:40:27.623427Z",
"id": "CVE-2026-120415",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:40:41.647Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120423.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "openjs",
"dateReserved": "2026-11-02T12:34:23.577Z",
"datePublished": "2026-11-06T10:08:32.545Z",
"dateUpdated": "2026-11-06T10:08:32.545Z"
"dateUpdated": "2026-11-10T17:39:59.015Z"
},
"containers": {
"cna": {
@@ -125,6 +125,40 @@
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:39:43.820702Z",
"id": "CVE-2026-120423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:39:59.015Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120474.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "openjs",
"dateReserved": "2026-11-02T13:47:10.769Z",
"datePublished": "2026-11-06T09:57:46.664Z",
"dateUpdated": "2026-11-06T09:57:46.664Z"
"dateUpdated": "2026-11-10T17:46:05.157Z"
},
"containers": {
"cna": {
@@ -135,6 +135,40 @@
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:45:36.174318Z",
"id": "CVE-2026-120474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:46:05.157Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121006.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CPANSec",
"dateReserved": "2026-11-03T07:58:36.822Z",
"datePublished": "2026-11-06T07:47:23.570Z",
"dateUpdated": "2026-11-06T19:05:07.229Z"
"dateUpdated": "2026-11-10T17:33:18.232Z"
},
"containers": {
"cna": {
@@ -104,6 +104,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-06T19:05:07.229Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:32:54.621629Z",
"id": "CVE-2026-121006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:33:18.232Z"
}
}
]
}
data/2026/121xxx/CVE-2026-121220.json
+60 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Chrome",
"dateReserved": "2026-11-03T10:33:08.182Z",
"datePublished": "2026-11-03T20:42:45.515Z",
"dateUpdated": "2026-11-03T20:42:45.515Z"
"dateUpdated": "2026-11-10T17:48:39.559Z"
},
"containers": {
"cna": {
@@ -56,6 +56,64 @@
"url": "https://issues.chromium.org/issues/553158297"
}
]
}
},
"adp": [
{
"references": [
{
"url": "https://issues.chromium.org/issues/553158297",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:48:33.039606Z",
"id": "CVE-2026-121220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:48:39.559Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121691.json
+199
View File
@@ -0,0 +1,199 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-121691",
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"state": "PUBLISHED",
"assignerShortName": "Secur0",
"dateReserved": "2026-11-03T20:07:54.134Z",
"datePublished": "2026-11-10T17:29:34.562Z",
"dateUpdated": "2026-11-10T17:29:34.562Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0",
"dateUpdated": "2026-11-10T17:29:34.562Z"
},
"title": "Unbounded decompression in the whatstk ZIP loader exhausts memory and disk",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "lucasrodes",
"product": "whatstk",
"collectionURL": "https://pypi.org",
"packageName": "whatstk",
"repo": "https://github.com/lucasrodes/whatstk",
"programFiles": [
"whatstk/whatsapp/parser.py"
],
"versions": [
{
"status": "affected",
"version": "0.7.0",
"lessThan": "0.9.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:lucasrodes:whatstk:*:*:*:*:*:python:*:*",
"versionStartIncluding": "0.7.0",
"versionEndExcluding": "0.9.0"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Handling of Highly Compressed Data (CWE-409) in the ZIP loader of whatstk from 0.7.0 before 0.9.0 allows a party that supplies a chat export to exhaust the memory and the disk of the process that parses it, because _str_from_file() (whatstk/whatsapp/parser.py) calls zip_ref.extractall() with no bound on the size of the members and no check of the compression ratio, then reads the extracted file in full with f.read(). The only guard on the archive counts the extracted files and raises when there is not exactly one, but it runs after extractall() has already written them, so it does not prevent the cost. _clean_text() then passes the whole text through unicodedata.normalize(\"NFKD\", text), which holds a second copy, and the parse builds a list of regular expression matches and a DataFrame over it, so peak memory is a multiple of the decompressed text rather than of the archive. A ZIP is a documented input of WhatsAppChat.from_source() and df_from_whatsapp(), and is the form in which WhatsApp exports a chat on iOS, so the attacker supplies the whole file. This results in a small upload costing hundreds of megabytes of memory and of disk, and in the process being killed where that exceeds what is available.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper Handling of Highly Compressed Data (CWE-409) in the ZIP loader of whatstk from 0.7.0 before 0.9.0 allows a party that supplies a chat export to exhaust the memory and the disk of the process that parses it, because <code>_str_from_file()</code> (<code>whatstk/whatsapp/parser.py</code>) calls <code>zip_ref.extractall()</code> with no bound on the size of the members and no check of the compression ratio, then reads the extracted file in full with <code>f.read()</code>. The only guard on the archive counts the extracted files and raises when there is not exactly one, but it runs after <code>extractall()</code> has already written them, so it does not prevent the cost. <code>_clean_text()</code> then passes the whole text through <code>unicodedata.normalize(\"NFKD\", text)</code>, which holds a second copy, and the parse builds a list of regular expression matches and a DataFrame over it, so peak memory is a multiple of the decompressed text rather than of the archive. A ZIP is a documented input of <code>WhatsAppChat.from_source()</code> and <code>df_from_whatsapp()</code>, and is the form in which WhatsApp exports a chat on iOS, so the attacker supplies the whole file. This results in a small upload costing hundreds of megabytes of memory and of disk, and in the process being killed where that exceeds what is available."
}
]
}
],
"tags": [
"x_open-source"
],
"references": [
{
"url": "https://github.com/lucasrodes/whatstk/pull/182",
"tags": [
"patch"
]
},
{
"url": "https://github.com/lucasrodes/whatstk/commit/01d66d8",
"tags": [
"patch"
]
},
{
"url": "https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0",
"tags": [
"release-notes"
]
},
{
"url": "https://secur0.com/en/cna/cve-list/cve-2026-121691-whatstk-zip-decompression-bomb",
"tags": [
"third-party-advisory",
"technical-description"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.7,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to whatstk 0.9.0 or later, which rejects a source larger than 50 MB by default and accepts a max_size argument to lower that bound.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Upgrade to whatstk 0.9.0 or later, which rejects a source larger than 50 MB by default and accepts a <code>max_size</code> argument to lower that bound."
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jorge Rey Cotallo (reddev)",
"type": "finder"
},
{
"lang": "en",
"value": "Xoán M. Otero Jorge",
"type": "analyst"
},
{
"lang": "en",
"value": "Darío Rivas",
"type": "analyst"
},
{
"lang": "en",
"value": "Secur0 CNA",
"type": "coordinator"
},
{
"lang": "en",
"value": "Lucas Rodés-Guirao",
"type": "remediation developer"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/121xxx/CVE-2026-121819.json
+48 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "LY-Corporation",
"dateReserved": "2026-11-04T05:50:04.721Z",
"datePublished": "2026-11-06T07:46:45.370Z",
"dateUpdated": "2026-11-06T07:46:45.370Z"
"dateUpdated": "2026-11-10T17:23:02.739Z"
},
"containers": {
"cna": {
@@ -66,6 +66,52 @@
"shortName": "LY-Corporation",
"dateUpdated": "2026-11-06T07:46:45.370Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-59",
"lang": "en",
"description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:22:34.642521Z",
"id": "CVE-2026-121819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:23:02.739Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121820.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "LY-Corporation",
"dateReserved": "2026-11-04T05:50:04.721Z",
"datePublished": "2026-11-06T07:46:48.261Z",
"dateUpdated": "2026-11-06T07:46:48.261Z"
"dateUpdated": "2026-11-10T17:24:41.043Z"
},
"containers": {
"cna": {
@@ -66,6 +66,40 @@
"shortName": "LY-Corporation",
"dateUpdated": "2026-11-06T07:46:48.261Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:24:04.893375Z",
"id": "CVE-2026-121820",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:24:41.043Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121821.json
+56 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "LY-Corporation",
"dateReserved": "2026-11-04T05:50:04.721Z",
"datePublished": "2026-11-06T07:46:50.787Z",
"dateUpdated": "2026-11-06T07:46:50.787Z"
"dateUpdated": "2026-11-10T17:26:35.550Z"
},
"containers": {
"cna": {
@@ -66,6 +66,60 @@
"shortName": "LY-Corporation",
"dateUpdated": "2026-11-06T07:46:50.787Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-942",
"lang": "en",
"description": "CWE-942 Permissive Cross-domain Policy with Untrusted Domains"
}
]
}
],
"references": [
{
"url": "https://github.com/line/armeria/security/advisories/GHSA-386q-mrg6-jfj8",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:26:30.974212Z",
"id": "CVE-2026-121821",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:26:35.550Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121822.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "LY-Corporation",
"dateReserved": "2026-11-04T05:50:04.721Z",
"datePublished": "2026-11-06T07:46:53.527Z",
"dateUpdated": "2026-11-06T07:46:53.527Z"
"dateUpdated": "2026-11-10T17:27:42.017Z"
},
"containers": {
"cna": {
@@ -66,6 +66,48 @@
"shortName": "LY-Corporation",
"dateUpdated": "2026-11-06T07:46:53.527Z"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/line/armeria/security/advisories/GHSA-x9vf-hjgg-cq25",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:26:53.598214Z",
"id": "CVE-2026-121822",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:27:42.017Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121823.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "LY-Corporation",
"dateReserved": "2026-11-04T05:50:04.722Z",
"datePublished": "2026-11-06T07:46:56.347Z",
"dateUpdated": "2026-11-06T07:46:56.347Z"
"dateUpdated": "2026-11-10T17:29:42.578Z"
},
"containers": {
"cna": {
@@ -66,6 +66,48 @@
"shortName": "LY-Corporation",
"dateUpdated": "2026-11-06T07:46:56.347Z"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/line/armeria/security/advisories/GHSA-xqhm-4ph4-423v",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:29:18.437980Z",
"id": "CVE-2026-121823",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:29:42.578Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121824.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "LY-Corporation",
"dateReserved": "2026-11-04T05:50:04.722Z",
"datePublished": "2026-11-06T07:46:59.325Z",
"dateUpdated": "2026-11-06T07:46:59.325Z"
"dateUpdated": "2026-11-10T17:31:12.964Z"
},
"containers": {
"cna": {
@@ -66,6 +66,48 @@
"shortName": "LY-Corporation",
"dateUpdated": "2026-11-06T07:46:59.325Z"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/line/armeria/security/advisories/GHSA-2pfv-5p52-crjm",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:30:41.519632Z",
"id": "CVE-2026-121824",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:31:12.964Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123087.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "INCIBE",
"dateReserved": "2026-11-05T11:54:54.482Z",
"datePublished": "2026-11-06T09:30:48.276Z",
"dateUpdated": "2026-11-06T09:30:48.276Z"
"dateUpdated": "2026-11-10T17:45:11.526Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:44:36.719507Z",
"id": "CVE-2026-123087",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:45:11.526Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123179.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-11-05T16:48:19.395Z",
"datePublished": "2026-11-10T15:49:44.908Z",
"dateUpdated": "2026-11-10T15:49:44.908Z"
"dateUpdated": "2026-11-10T17:33:07.728Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T15:49:44.908Z"
"dateUpdated": "2026-11-10T17:33:07.728Z"
},
"problemTypes": [
{
@@ -67,12 +67,12 @@
"descriptions": [
{
"lang": "en",
"value": "An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a local authenticated attacker to cause a denial of service.",
"value": "An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenticated attacker to cause a denial of service.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<table><tbody><tr><td colspan=\"1\" rowspan=\"1\"><div><div><p>An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a local authenticated attacker to cause a denial of service.&nbsp;</p></div></div></td></tr></tbody></table>"
"value": "An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenticated attacker to cause a denial of service.&nbsp;"
}
]
}
data/2026/123xxx/CVE-2026-123181.json
+4 -4
View File
@@ -8,14 +8,14 @@
"assignerShortName": "ivanti",
"dateReserved": "2026-11-05T16:55:42.443Z",
"datePublished": "2026-11-10T15:52:01.338Z",
"dateUpdated": "2026-11-10T15:52:01.338Z"
"dateUpdated": "2026-11-10T17:33:46.264Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti",
"dateUpdated": "2026-11-10T15:52:01.338Z"
"dateUpdated": "2026-11-10T17:33:46.264Z"
},
"problemTypes": [
{
@@ -65,12 +65,12 @@
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.",
"value": "A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.&nbsp;"
"value": "A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges."
}
]
}
data/2026/123xxx/CVE-2026-123301.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "JetBrains",
"dateReserved": "2026-11-05T18:38:21.235Z",
"datePublished": "2026-11-06T10:27:58.145Z",
"dateUpdated": "2026-11-06T10:27:58.145Z"
"dateUpdated": "2026-11-10T17:47:55.557Z"
},
"containers": {
"cna": {
@@ -79,6 +79,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:47:34.720283Z",
"id": "CVE-2026-123301",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:47:55.557Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123319.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "JetBrains",
"dateReserved": "2026-11-05T18:38:26.991Z",
"datePublished": "2026-11-06T10:28:05.274Z",
"dateUpdated": "2026-11-06T10:28:05.274Z"
"dateUpdated": "2026-11-10T17:50:08.481Z"
},
"containers": {
"cna": {
@@ -79,6 +79,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:49:12.446472Z",
"id": "CVE-2026-123319",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:50:08.481Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123320.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "JetBrains",
"dateReserved": "2026-11-05T18:38:27.309Z",
"datePublished": "2026-11-06T10:28:05.629Z",
"dateUpdated": "2026-11-06T10:28:05.629Z"
"dateUpdated": "2026-11-10T17:46:35.039Z"
},
"containers": {
"cna": {
@@ -79,6 +79,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:46:02.566094Z",
"id": "CVE-2026-123320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:46:35.039Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123322.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "JetBrains",
"dateReserved": "2026-11-05T18:38:28.086Z",
"datePublished": "2026-11-06T10:28:06.467Z",
"dateUpdated": "2026-11-06T10:28:06.467Z"
"dateUpdated": "2026-11-10T17:45:37.272Z"
},
"containers": {
"cna": {
@@ -79,6 +79,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:45:20.765241Z",
"id": "CVE-2026-123322",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:45:37.272Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123660.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CIRCL",
"dateReserved": "2026-11-06T08:57:03.368Z",
"datePublished": "2026-11-06T08:58:24.857Z",
"dateUpdated": "2026-11-06T09:04:51.732Z"
"dateUpdated": "2026-11-10T17:40:09.862Z"
},
"containers": {
"cna": {
@@ -303,6 +303,40 @@
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:39:52.273550Z",
"id": "CVE-2026-123660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:40:09.862Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125320.json
+112
View File
@@ -0,0 +1,112 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125320",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.597Z",
"datePublished": "2026-11-10T17:23:43.734Z",
"dateUpdated": "2026-11-10T17:23:43.734Z"
},
"containers": {
"cna": {
"title": "pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"lang": "en",
"description": "CWE-346: Origin Validation Error",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-6hg5-9f3w-c886"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/231"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/232"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/5571bd492a803e8f8831599c88b4619c5041fd8e"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"affected": [
{
"vendor": "pgEdge",
"product": "pgedge-postgres-mcp",
"versions": [
{
"version": "< 1.1.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-10T17:23:43.734Z"
},
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the HTTP transport did not validate the Origin header on incoming requests. A user who visited an attacker-controlled page could be targeted through DNS rebinding, allowing the page to reach a locally running server and read schemas and query results from configured databases. The issue affected deployments with the HTTP transport enabled on a machine that also ran a browser, while the default stdio transport was not reachable through this path. This issue is fixed in version 1.1.0."
}
],
"source": {
"advisory": "GHSA-6hg5-9f3w-c886",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/125xxx/CVE-2026-125321.json
+115
View File
@@ -0,0 +1,115 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125321",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.597Z",
"datePublished": "2026-11-10T17:36:23.877Z",
"dateUpdated": "2026-11-10T17:36:23.877Z"
},
"containers": {
"cna": {
"title": "pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-807",
"lang": "en",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v347-v3w7-7fq9"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/204"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/205"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/6a19e46a240b9f4661a4a253811948dd75c4077e"
}
],
"affected": [
{
"vendor": "pgEdge",
"product": "pgedge-postgres-mcp",
"versions": [
{
"version": "< 1.1.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-10T17:36:23.877Z"
},
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client address for login rate limiting. ExtractIPAddress in internal/auth/middleware.go supplied that value to IsAllowed and RecordFailedAttempt in internal/auth/rate_limiter.go, allowing an unauthenticated caller to rotate addresses to evade throttling or assert another user's address to consume that user's limiter bucket. The published nginx configuration appended rather than replaced X-Forwarded-For, making the issue reachable without an operator misconfiguration. Username-keyed account lockout did not use the client address, but shipped defaults disabled that separate control through MaxFailedAttemptsBeforeLockout: 0. This issue is fixed in version 1.1.0."
}
],
"source": {
"advisory": "GHSA-v347-v3w7-7fq9",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/125xxx/CVE-2026-125322.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125322",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.597Z",
"datePublished": "2026-11-10T17:39:00.060Z",
"dateUpdated": "2026-11-10T17:39:00.060Z"
},
"containers": {
"cna": {
"title": "pgEdge Postgres MCP Server SQL injection in the count_rows where parameter",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"lang": "en",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-209",
"lang": "en",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-fhv3-x3jh-grj7"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/issues/200"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/pull/201"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/commit/933f1b4cb136183eb307064c1cf1ad2bf015f314"
},
{
"name": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"
}
],
"affected": [
{
"vendor": "pgEdge",
"product": "pgedge-postgres-mcp",
"versions": [
{
"version": "< 1.1.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-10T17:39:00.060Z"
},
"descriptions": [
{
"lang": "en",
"value": "pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates and the returned row count as an inference oracle to extract data from any other table that the connected database role could read. The database privilege boundary remained intact, and the flaw did not grant access to tables outside that role's existing SELECT privileges. This issue is fixed in version 1.1.0."
}
],
"source": {
"advisory": "GHSA-fhv3-x3jh-grj7",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/125xxx/CVE-2026-125342.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125342",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:42:54.096Z",
"datePublished": "2026-11-10T17:20:21.607Z",
"dateUpdated": "2026-11-10T17:20:21.607Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Uninitialized resource",
"cweId": "CWE-908"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:21.607Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/566384898"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125343.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125343",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:42:57.312Z",
"datePublished": "2026-11-10T17:20:20.233Z",
"dateUpdated": "2026-11-10T17:20:20.233Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Buffer overflow",
"cweId": "CWE-122"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:20.233Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/561998123"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125344.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125344",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:42:58.360Z",
"datePublished": "2026-11-10T17:20:20.692Z",
"dateUpdated": "2026-11-10T17:20:20.692Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Type confusion",
"cweId": "CWE-843"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:20.692Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/568893995"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125345.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125345",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:42:59.429Z",
"datePublished": "2026-11-10T17:20:19.715Z",
"dateUpdated": "2026-11-10T17:20:19.715Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Uninitialized resource",
"cweId": "CWE-908"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:19.715Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/550525698"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125346.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125346",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:43:04.617Z",
"datePublished": "2026-11-10T17:20:20.915Z",
"dateUpdated": "2026-11-10T17:20:20.915Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Use after free",
"cweId": "CWE-416"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:20.915Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/572578603"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125347.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125347",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:43:06.554Z",
"datePublished": "2026-11-10T17:20:20.019Z",
"dateUpdated": "2026-11-10T17:20:20.019Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect authorization",
"cweId": "CWE-863"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:20.019Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/561996724"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125348.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125348",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:43:08.055Z",
"datePublished": "2026-11-10T17:20:20.455Z",
"dateUpdated": "2026-11-10T17:20:20.455Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Out of bounds write",
"cweId": "CWE-787"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:20.455Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/563358700"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125349.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125349",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:43:09.709Z",
"datePublished": "2026-11-10T17:20:21.382Z",
"dateUpdated": "2026-11-10T17:20:21.382Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Uninitialized resource",
"cweId": "CWE-908"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:21.382Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/536663516"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125350.json
+61
View File
@@ -0,0 +1,61 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125350",
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"state": "PUBLISHED",
"assignerShortName": "Chrome",
"dateReserved": "2026-11-09T21:43:19.223Z",
"datePublished": "2026-11-10T17:20:21.161Z",
"dateUpdated": "2026-11-10T17:20:21.161Z"
},
"containers": {
"cna": {
"affected": [
{
"vendor": "Google",
"product": "Chrome",
"versions": [
{
"version": "157.0.8103.50",
"status": "affected",
"lessThan": "157.0.8103.50",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Use after free",
"cweId": "CWE-416"
}
]
}
],
"providerMetadata": {
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome",
"dateUpdated": "2026-11-10T17:20:21.161Z"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
},
{
"url": "https://issues.chromium.org/issues/582442907"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125729.json
+95
View File
@@ -0,0 +1,95 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125729",
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"state": "PUBLISHED",
"assignerShortName": "CPANSec",
"dateReserved": "2026-11-10T11:17:20.551Z",
"datePublished": "2026-11-10T17:35:57.712Z",
"dateUpdated": "2026-11-10T17:35:57.712Z"
},
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Plack::Middleware::CSP"
],
"packageName": "Plack-Middleware-CSP",
"packageURL": "pkg:cpan/Plack-Middleware-CSP",
"programFiles": [
"lib/Plack/Middleware/CSP.pm"
],
"programRoutines": [
{
"name": "Plack::Middleware::CSP::call"
}
],
"repo": "https://github.com/pangyre/Plack-Middleware-CSP/",
"versions": [
{
"lessThan": "0.03",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.\n\nThe call method sets the policy in a response header named \"content-security-protocol\" instead of \"Content-Security-Policy\". Browsers ignore that header.\n\nAny cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-684",
"description": "CWE-684 Incorrect Provision of Specified Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec",
"dateUpdated": "2026-11-10T17:35:57.712Z"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/pangyre/Plack-Middleware-CSP/issues/1"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/ASHLEY/Plack-Middleware-CSP-0.03/source/CHANGES"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Plack-Middleware-CSP 0.03 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
}
}
data/2026/126xxx/CVE-2026-126048.json
+141
View File
@@ -0,0 +1,141 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126048",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T16:53:12.633Z",
"datePublished": "2026-11-10T16:58:03.611Z",
"dateUpdated": "2026-11-10T16:58:03.611Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-10T16:58:03.611Z"
},
"datePublic": "2026-11-09T00:00:00.000Z",
"title": "Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()",
"descriptions": [
{
"lang": "en",
"value": "Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Stack-based Buffer Overflow",
"cweId": "CWE-121",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Martin Preuss",
"product": "Gwenhywfar",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.99.8beta",
"status": "affected",
"versionType": "custom",
"lessThan": "5.14.2"
}
],
"packageURL": "pkg:github/aqbanking/gwenhywfar",
"repo": "https://github.com/aqbanking/gwenhywfar"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 4.6,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757",
"tags": [
"patch"
]
},
{
"url": "https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39",
"tags": [
"patch"
]
},
{
"url": "https://www.aquamaniac.de/rdm/projects/gwenhywfar/files",
"tags": [
"product"
]
},
{
"url": "https://github.com/aqbanking/gwenhywfar/blob/424949d0c6e61028eaccd6e46e4c0c41931c2b2f/src/parser/tlv.c#L629-L655",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gwenhywfar-4.99-8beta-before-5.14.2-stack-buffer-overflow-via-gwen-tlv-buffer-to-db"
}
],
"credits": [
{
"lang": "en",
"value": "Deus Rex",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126049.json
+142
View File
@@ -0,0 +1,142 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126049",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T16:53:12.633Z",
"datePublished": "2026-11-10T16:58:04.296Z",
"dateUpdated": "2026-11-10T16:58:04.296Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-10T16:58:04.296Z"
},
"datePublic": "2026-11-10T00:00:00.000Z",
"title": "Gwenhywfar 5.14.2 Use-After-Free via GWEN_TLV_Buffer_To_DB() Nested BER-TLV Parsing",
"descriptions": [
{
"lang": "en",
"value": "Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Use After Free",
"cweId": "CWE-416",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Martin Preuss",
"product": "Gwenhywfar",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.14.2",
"status": "affected",
"versionType": "custom",
"lessThan": "5.14.3"
}
],
"packageURL": "pkg:github/aqbanking/gwenhywfar",
"repo": "https://github.com/aqbanking/gwenhywfar"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 4.6,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738",
"tags": [
"patch"
]
},
{
"url": "https://github.com/aqbanking/gwenhywfar/commit/dc8b80945e877f5bdf2d2ae1b50c928c15e990b0",
"tags": [
"release-notes",
"patch"
]
},
{
"url": "https://www.aquamaniac.de/rdm/projects/gwenhywfar/files",
"tags": [
"product"
]
},
{
"url": "https://github.com/aqbanking/gwenhywfar/blob/f5c3f9dc56aa20cab85fd149885474239cf68632/src/parser/tlv.c#L651-L672",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Gwenhywfar 5.14.2 Use-After-Free via GWEN_TLV_Buffer_To_DB() Nested BER-TLV Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gwenhywfar-5.14.2-use-after-free-via-gwen-tlv-buffer-to-db-nested-ber-tlv-parsing"
}
],
"credits": [
{
"lang": "en",
"value": "Deus Rex",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126050.json
+129
View File
@@ -0,0 +1,129 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126050",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T16:53:12.633Z",
"datePublished": "2026-11-10T16:58:04.990Z",
"dateUpdated": "2026-11-10T16:58:04.990Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-10T16:58:04.990Z"
},
"datePublic": "2026-11-10T00:00:00.000Z",
"title": "apitrace 2.0 through 14.0 Heap Buffer Overflow via SnappyFile::flushReadCache()",
"descriptions": [
{
"lang": "en",
"value": "apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Heap-based Buffer Overflow",
"cweId": "CWE-122",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "apitrace",
"product": "apitrace",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "14.0"
}
],
"packageURL": "pkg:github/apitrace/apitrace",
"repo": "https://github.com/apitrace/apitrace"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395",
"tags": [
"patch"
]
},
{
"url": "https://github.com/apitrace/apitrace/blob/18cfd388ac47a9e00978b34d6c20341f3e2cdb56/lib/trace/trace_file_snappy.cpp#L215-L235",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: apitrace 2.0 through 14.0 Heap Buffer Overflow via SnappyFile::flushReadCache()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/apitrace-2.0-through-14.0-heap-buffer-overflow-via-snappyfile-flushreadcache"
}
],
"credits": [
{
"lang": "en",
"value": "Deus Rex",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/16xxx/CVE-2026-16530.json
+19 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-22T07:57:32.480Z",
"datePublished": "2026-07-30T05:30:59.912Z",
"dateUpdated": "2026-11-05T19:23:59.346Z"
"dateUpdated": "2026-11-10T17:46:17.674Z"
},
"containers": {
"cna": {
@@ -54,8 +54,16 @@
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "pcp",
"defaultStatus": "affected",
"versions": [
{
"version": "0:7.1.5-6.el10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
@@ -120,6 +128,14 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:97299",
"name": "RHSA-2026:97299",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-16530",
"tags": [
@@ -177,7 +193,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T19:23:59.346Z"
"dateUpdated": "2026-11-10T17:46:17.674Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/16xxx/CVE-2026-16531.json
+19 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-22T08:02:56.004Z",
"datePublished": "2026-07-30T05:41:07.583Z",
"dateUpdated": "2026-11-05T19:24:02.312Z"
"dateUpdated": "2026-11-10T17:46:17.823Z"
},
"containers": {
"cna": {
@@ -54,8 +54,16 @@
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "pcp",
"defaultStatus": "affected",
"versions": [
{
"version": "0:7.1.5-6.el10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
@@ -120,6 +128,14 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:97299",
"name": "RHSA-2026:97299",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-16531",
"tags": [
@@ -177,7 +193,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-05T19:24:02.312Z"
"dateUpdated": "2026-11-10T17:46:17.823Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/19xxx/CVE-2026-19876.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "NCSC.ch",
"dateReserved": "2026-08-14T14:11:08.840Z",
"datePublished": "2026-11-06T08:29:25.674Z",
"dateUpdated": "2026-11-06T08:29:25.674Z"
"dateUpdated": "2026-11-10T17:38:08.513Z"
},
"containers": {
"cna": {
@@ -120,6 +120,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:36:05.477130Z",
"id": "CVE-2026-19876",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:38:08.513Z"
}
}
]
}
}
data/2026/19xxx/CVE-2026-19877.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "NCSC.ch",
"dateReserved": "2026-08-14T14:11:08.980Z",
"datePublished": "2026-11-06T08:30:14.583Z",
"dateUpdated": "2026-11-06T08:30:14.583Z"
"dateUpdated": "2026-11-10T17:39:24.921Z"
},
"containers": {
"cna": {
@@ -126,6 +126,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:38:51.525813Z",
"id": "CVE-2026-19877",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:39:24.921Z"
}
}
]
}
}
data/2026/20xxx/CVE-2026-20703.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-20703",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-01-13T04:00:20.851Z",
"datePublished": "2026-11-10T17:43:52.494Z",
"dateUpdated": "2026-11-10T17:43:52.494Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:43:52.494Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Protection Mechanism Failure",
"cweId": "CWE-693",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "BigDL",
"versions": [
{
"version": "before version 2.4.0",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Protection mechanism failure for some BigDL before version 2.4.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01553.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01553.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/28xxx/CVE-2026-28730.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-28730",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-11T03:00:25.846Z",
"datePublished": "2026-11-10T17:44:02.403Z",
"dateUpdated": "2026-11-10T17:44:02.403Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:02.403Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "NULL Pointer Dereference",
"cweId": "CWE-476",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Hyperscan",
"versions": [
{
"version": "before version v5.4.2.1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Null pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/28xxx/CVE-2026-28746.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-28746",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-02T03:00:20.878Z",
"datePublished": "2026-11-10T17:44:06.178Z",
"dateUpdated": "2026-11-10T17:44:06.178Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:06.178Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Out-of-bounds Read",
"cweId": "CWE-125",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Slim Bootloader",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read in the AuthenticateComponent for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/32xxx/CVE-2026-32146.json
+166 -76
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-03-10T22:37:29.213Z",
"datePublished": "2026-04-11T12:59:22.911Z",
"dateUpdated": "2026-09-08T00:58:49.792Z"
"dateUpdated": "2026-11-10T17:40:31.314Z"
},
"containers": {
"cna": {
@@ -39,73 +39,16 @@
"vendor": "Gleam",
"versions": [
{
"changes": [
{
"at": "1.15.4",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "1.9.0-rc1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"compiler-core"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:github/gleam-lang/gleam",
"product": "Gleam",
"programFiles": [
"compiler-core/src/config.rs",
"compiler-core/src/manifest.rs"
],
"programRoutines": [
{
"name": "compiler_core::config::dependencies_map::deserialize"
},
{
"name": "compiler_core::config::package_name::deserialize"
}
],
"repo": "https://github.com/gleam-lang/gleam",
"vendor": "Gleam",
"versions": [
{
"changes": [
{
"at": "1.15.4",
"status": "unaffected"
}
],
"lessThan": "*",
"lessThan": "1.15.4",
"status": "affected",
"version": "1.9.0-rc1",
"versionType": "semver"
},
{
"changes": [
{
"at": "92aae3913570e8d8962f6399404777d313045bfa",
"status": "unaffected"
},
{
"at": "2dc0467f822c75de94697a912755d172928ee40a",
"status": "unaffected"
}
],
"lessThan": "*",
"lessThan": "1.16.0-rc2",
"status": "affected",
"version": "a4fde22445ab8e5cc79c2ff48971616cb570702c",
"versionType": "git"
"version": "1.16.0-rc1",
"versionType": "semver"
}
]
},
@@ -119,7 +62,7 @@
"compiler-core"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:oci/gleam?repository_url=ghcr.io/gleam-lang",
"packageURL": "pkg:oci/gleam?repository_url=ghcr.io%2Fgleam-lang%2Fgleam",
"product": "Gleam",
"programFiles": [
"compiler-core/src/config.rs",
@@ -194,6 +137,111 @@
"status": "affected",
"version": "v1.9.0-rc1-scratch",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-elixir",
"status": "affected",
"version": "v1.16.0-rc1-elixir",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-erlang",
"status": "affected",
"version": "v1.16.0-rc1-erlang",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-node",
"status": "affected",
"version": "v1.16.0-rc1-node",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-node-slim",
"status": "affected",
"version": "v1.16.0-rc1-node-slim",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-elixir-slim",
"status": "affected",
"version": "v1.16.0-rc1-elixir-slim",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-erlang-slim",
"status": "affected",
"version": "v1.16.0-rc1-erlang-slim",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-erlang-alpine",
"status": "affected",
"version": "v1.16.0-rc1-erlang-alpine",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-elixir-alpine",
"status": "affected",
"version": "v1.16.0-rc1-elixir-alpine",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-node-alpine",
"status": "affected",
"version": "v1.16.0-rc1-node-alpine",
"versionType": "other"
},
{
"lessThan": "v1.16.0-rc2-scratch",
"status": "affected",
"version": "v1.16.0-rc1-scratch",
"versionType": "other"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"compiler-core"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:github/gleam-lang/gleam",
"product": "Gleam",
"programFiles": [
"compiler-core/src/config.rs",
"compiler-core/src/manifest.rs"
],
"programRoutines": [
{
"name": "compiler_core::config::dependencies_map::deserialize"
},
{
"name": "compiler_core::config::package_name::deserialize"
}
],
"repo": "https://github.com/gleam-lang/gleam",
"vendor": "Gleam",
"versions": [
{
"changes": [
{
"at": "2dc0467f822c75de94697a912755d172928ee40a",
"status": "unaffected"
},
{
"at": "92aae3913570e8d8962f6399404777d313045bfa",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "a4fde22445ab8e5cc79c2ff48971616cb570702c",
"versionType": "git"
}
]
}
@@ -205,7 +253,12 @@
{
"base64": false,
"type": "text/html",
"value": "<p>The project must use git-based dependencies (direct or transitive), or the victim must run <tt>gleam deps download</tt> on a repository with a malicious <tt>manifest.toml</tt> lockfile. Projects that exclusively use Hex dependencies and do not clone untrusted repositories are not affected.</p><p>Projects that exclusively use trusted or personally controlled git dependencies, or dependencies pinned to verified commit SHAs, are not exposed.</p>"
"value": "<p>The project must use git-based dependencies (direct or transitive), or the victim must run <code>gleam deps download</code> on a repository with a malicious <code>manifest.toml</code> lockfile. Projects that exclusively use Hex dependencies and do not clone untrusted repositories are not affected.</p>\n<p>Projects that exclusively use trusted or personally controlled git dependencies, or dependencies pinned to verified commit SHAs, are not exposed.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The project must use git-based dependencies (direct or transitive), or the victim must run `gleam deps download` on a repository with a malicious `manifest.toml` lockfile. Projects that exclusively use Hex dependencies and do not clone untrusted repositories are not affected.\n\nProjects that exclusively use trusted or personally controlled git dependencies, or dependencies pinned to verified commit SHAs, are not exposed."
}
],
"value": "The project must use git-based dependencies (direct or transitive), or the victim must run gleam deps download on a repository with a malicious manifest.toml lockfile. Projects that exclusively use Hex dependencies and do not clone untrusted repositories are not affected.\n\nProjects that exclusively use trusted or personally controlled git dependencies, or dependencies pinned to verified commit SHAs, are not exposed."
@@ -221,12 +274,19 @@
"versionEndExcluding": "1.15.4",
"versionStartIncluding": "1.9.0-rc1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.16.0-rc2",
"versionStartIncluding": "1.16.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
],
"operator": "AND"
}
],
"credits": [
@@ -253,10 +313,15 @@
{
"base64": false,
"type": "text/html",
"value": "Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download.<p>Dependency names from <tt>gleam.toml</tt> and <tt>manifest.toml</tt> are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such as <tt>../</tt> or absolute paths) to target filesystem locations outside that directory. When resolving git dependencies (e.g. via <tt>gleam deps download</tt>), the computed path is used for filesystem operations including directory deletion and creation.</p><p>This vulnerability occurs during the dependency resolution and download phase, which is generally expected to be limited to fetching and preparing dependencies within a confined directory. A malicious direct or transitive git dependency can exploit this issue to delete and overwrite arbitrary directories outside the intended dependency directory, including attacker-chosen absolute paths, potentially causing data loss. In some environments, this may be further leveraged to achieve code execution, for example by overwriting git hooks or shell configuration files.</p><p>This issue affects Gleam from 1.9.0-rc1 until 1.15.4.</p>"
"value": "<p>Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download.</p>\n<p>Dependency names from <code>gleam.toml</code> and <code>manifest.toml</code> are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such as <code>../</code> or absolute paths) to target filesystem locations outside that directory. When resolving git dependencies (e.g. via <code>gleam deps download</code>), the computed path is used for filesystem operations including directory deletion and creation.</p>\n<p>This vulnerability occurs during the dependency resolution and download phase, which is generally expected to be limited to fetching and preparing dependencies within a confined directory. A malicious direct or transitive git dependency can exploit this issue to delete and overwrite arbitrary directories outside the intended dependency directory, including attacker-chosen absolute paths, potentially causing data loss. In some environments, this may be further leveraged to achieve code execution, for example by overwriting git hooks or shell configuration files.</p>\n<p>This issue affects gleam: from 1.9.0-rc1 before 1.15.4 and from 1.16.0-rc1 before 1.16.0-rc2.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download.\n\nDependency names from `gleam.toml` and `manifest.toml` are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such as `../` or absolute paths) to target filesystem locations outside that directory. When resolving git dependencies (e.g. via `gleam deps download`), the computed path is used for filesystem operations including directory deletion and creation.\n\nThis vulnerability occurs during the dependency resolution and download phase, which is generally expected to be limited to fetching and preparing dependencies within a confined directory. A malicious direct or transitive git dependency can exploit this issue to delete and overwrite arbitrary directories outside the intended dependency directory, including attacker-chosen absolute paths, potentially causing data loss. In some environments, this may be further leveraged to achieve code execution, for example by overwriting git hooks or shell configuration files.\n\nThis issue affects gleam: from 1.9.0-rc1 before 1.15.4 and from 1.16.0-rc1 before 1.16.0-rc2."
}
],
"value": "Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download.\n\nDependency names from gleam.toml and manifest.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such as ../ or absolute paths) to target filesystem locations outside that directory. When resolving git dependencies (e.g. via gleam deps download), the computed path is used for filesystem operations including directory deletion and creation.\n\nThis vulnerability occurs during the dependency resolution and download phase, which is generally expected to be limited to fetching and preparing dependencies within a confined directory. A malicious direct or transitive git dependency can exploit this issue to delete and overwrite arbitrary directories outside the intended dependency directory, including attacker-chosen absolute paths, potentially causing data loss. In some environments, this may be further leveraged to achieve code execution, for example by overwriting git hooks or shell configuration files.\n\nThis issue affects Gleam from 1.9.0-rc1 until 1.15.4."
"value": "Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download.\n\nDependency names from gleam.toml and manifest.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such as ../ or absolute paths) to target filesystem locations outside that directory. When resolving git dependencies (e.g. via gleam deps download), the computed path is used for filesystem operations including directory deletion and creation.\n\nThis vulnerability occurs during the dependency resolution and download phase, which is generally expected to be limited to fetching and preparing dependencies within a confined directory. A malicious direct or transitive git dependency can exploit this issue to delete and overwrite arbitrary directories outside the intended dependency directory, including attacker-chosen absolute paths, potentially causing data loss. In some environments, this may be further leveraged to achieve code execution, for example by overwriting git hooks or shell configuration files.\n\nThis issue affects gleam: from 1.9.0-rc1 before 1.15.4 and from 1.16.0-rc1 before 1.16.0-rc2."
}
],
"impacts": [
@@ -290,7 +355,6 @@
"attackVector": "LOCAL",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
@@ -319,7 +383,7 @@
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
@@ -329,10 +393,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-09-08T00:58:49.792Z"
"dateUpdated": "2026-11-10T17:40:31.314Z"
},
"references": [
{
"name": "Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification",
"tags": [
"vendor-advisory",
"related"
@@ -340,28 +405,46 @@
"url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-vq5j-55vx-wq8j"
},
{
"name": "EEF CNA record for CVE-2026-32146",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-32146.html"
},
{
"name": "OSV record EEF-CVE-2026-32146",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32146"
},
{
"name": "Error immediately for invalid config",
"tags": [
"patch"
],
"url": "https://github.com/gleam-lang/gleam/commit/1aa5d8e594b0aa240bb213fce6ee19c65e6d5bcf"
},
{
"name": "Introducing commit a4fde22 in gleam-lang/gleam",
"tags": [
"related"
],
"url": "https://github.com/gleam-lang/gleam/commit/a4fde22445ab8e5cc79c2ff48971616cb570702c"
},
{
"name": "Fix commit 2dc0467 in gleam-lang/gleam",
"tags": [
"patch"
],
"url": "https://github.com/gleam-lang/gleam/commit/2dc0467f822c75de94697a912755d172928ee40a"
},
{
"name": "Fix commit 92aae39 in gleam-lang/gleam",
"tags": [
"patch"
],
"url": "https://github.com/gleam-lang/gleam/commit/92aae3913570e8d8962f6399404777d313045bfa"
}
],
"solutions": [
@@ -371,7 +454,12 @@
{
"base64": false,
"type": "text/html",
"value": "<p>Upgrade to Gleam 1.15.4 or later.</p><p>Both patches must be applied: the original incomplete fix (<tt>1aa5d8e594b0aa240bb213fce6ee19c65e6d5bcf</tt>, backported as <tt>55bb36e6d7febfbbc48c4d001e0ae13eb0312d78</tt> to 1.15) and the follow-up fix (<tt>2dc0467f822c75de94697a912755d172928ee40a</tt>, backported as <tt>92aae3913570e8d8962f6399404777d313045bfa</tt> to 1.15). Gleam 1.15.4 includes both.</p>"
"value": "<p>Upgrade to Gleam 1.15.4 or later.</p>\n<p>Both patches must be applied: the original incomplete fix (<code>1aa5d8e594b0aa240bb213fce6ee19c65e6d5bcf</code>, backported as <code>55bb36e6d7febfbbc48c4d001e0ae13eb0312d78</code> to 1.15) and the follow-up fix (<code>2dc0467f822c75de94697a912755d172928ee40a</code>, backported as <code>92aae3913570e8d8962f6399404777d313045bfa</code> to 1.15). Gleam 1.15.4 includes both.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Upgrade to Gleam 1.15.4 or later.\n\nBoth patches must be applied: the original incomplete fix (`1aa5d8e594b0aa240bb213fce6ee19c65e6d5bcf`, backported as `55bb36e6d7febfbbc48c4d001e0ae13eb0312d78` to 1.15) and the follow-up fix (`2dc0467f822c75de94697a912755d172928ee40a`, backported as `92aae3913570e8d8962f6399404777d313045bfa` to 1.15). Gleam 1.15.4 includes both."
}
],
"value": "Upgrade to Gleam 1.15.4 or later.\n\nBoth patches must be applied: the original incomplete fix (1aa5d8e594b0aa240bb213fce6ee19c65e6d5bcf, backported as 55bb36e6d7febfbbc48c4d001e0ae13eb0312d78 to 1.15) and the follow-up fix (2dc0467f822c75de94697a912755d172928ee40a, backported as 92aae3913570e8d8962f6399404777d313045bfa to 1.15). Gleam 1.15.4 includes both."
@@ -388,15 +476,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>Avoid using untrusted git dependencies, especially without pinning to a specific commit SHA</li><li>Review dependency trees carefully, including transitive git dependencies</li><li>Run dependency resolution commands in a restricted or isolated environment (e.g. containers)</li></ul>"
"value": "<ul>\n<li>Avoid using untrusted git dependencies, especially without pinning to a specific commit SHA</li>\n<li>Review dependency trees carefully, including transitive git dependencies</li>\n<li>Run dependency resolution commands in a restricted or isolated environment (e.g. containers)</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Avoid using untrusted git dependencies, especially without pinning to a specific commit SHA\n* Review dependency trees carefully, including transitive git dependencies\n* Run dependency resolution commands in a restricted or isolated environment (e.g. containers)"
}
],
"value": "* Avoid using untrusted git dependencies, especially without pinning to a specific commit SHA\n* Review dependency trees carefully, including transitive git dependencies\n* Run dependency resolution commands in a restricted or isolated environment (e.g. containers)"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/33xxx/CVE-2026-33094.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-33094",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-11T03:00:25.868Z",
"datePublished": "2026-11-10T17:44:15.176Z",
"dateUpdated": "2026-11-10T17:44:15.176Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:15.176Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Hyperscan",
"versions": [
{
"version": "before version v5.4.2.1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/33xxx/CVE-2026-33275.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-33275",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-02T03:00:20.849Z",
"datePublished": "2026-11-10T17:44:19.114Z",
"dateUpdated": "2026-11-10T17:44:19.114Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:19.114Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Improper Resource Shutdown or Release",
"cweId": "CWE-404",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) PROSet/Wireless Wi-Fi Software for Windows",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper resource shutdown or release for some Intel(R) PROSet/Wireless Wi-Fi Software for Windows within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/33xxx/CVE-2026-33379.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GRAFANA",
"dateReserved": "2026-03-19T07:55:06.977Z",
"datePublished": "2026-11-06T10:05:44.477Z",
"dateUpdated": "2026-11-06T10:05:44.477Z"
"dateUpdated": "2026-11-10T17:39:19.777Z"
},
"containers": {
"cna": {
@@ -93,6 +93,40 @@
"discovery": "BUG_BOUNTY"
},
"title": "Dashboard snapshot permission bypass"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-10T17:39:05.352293Z",
"id": "CVE-2026-33379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-10T17:39:19.777Z"
}
}
]
}
}
data/2026/33xxx/CVE-2026-33818.json
+2 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Go",
"dateReserved": "2026-03-23T20:35:32.815Z",
"datePublished": "2026-08-13T21:58:52.821Z",
"dateUpdated": "2026-11-10T11:21:21.296Z"
"dateUpdated": "2026-11-10T17:20:47.076Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go",
"dateUpdated": "2026-11-10T11:21:21.296Z"
"dateUpdated": "2026-11-10T17:20:47.076Z"
},
"title": "Enforce maximum recursion depth in encoding/asn1",
"descriptions": [
data/2026/34xxx/CVE-2026-34017.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-34017",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-15T03:00:23.189Z",
"datePublished": "2026-11-10T17:44:28.084Z",
"dateUpdated": "2026-11-10T17:44:28.084Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:28.084Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Heap-based Buffer Overflow",
"cweId": "CWE-122",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Hyperscan",
"versions": [
{
"version": "before version v5.4.2.1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/34xxx/CVE-2026-34489.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-34489",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-15T03:00:23.205Z",
"datePublished": "2026-11-10T17:44:30.858Z",
"dateUpdated": "2026-11-10T17:44:30.858Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:30.858Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Untrusted Pointer Dereference",
"cweId": "CWE-822",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Hyperscan",
"versions": [
{
"version": "before version v5.4.2.1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Untrusted pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/35xxx/CVE-2026-35500.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-35500",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-18T03:00:24.870Z",
"datePublished": "2026-11-10T17:44:34.959Z",
"dateUpdated": "2026-11-10T17:44:34.959Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:34.959Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Stack-based Buffer Overflow",
"cweId": "CWE-121",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Slim Bootloader",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40064.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40064",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-04T03:00:12.196Z",
"datePublished": "2026-11-10T17:44:41.827Z",
"dateUpdated": "2026-11-10T17:44:41.827Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:41.827Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Improper Input Validation",
"cweId": "CWE-20",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) oneAPI CLI Tool software",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation for some Intel(R) oneAPI CLI Tool software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01522.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01522.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40216.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40216",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-11T03:00:25.826Z",
"datePublished": "2026-11-10T17:44:46.097Z",
"dateUpdated": "2026-11-10T17:44:46.097Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:46.097Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Out-of-bounds Read",
"cweId": "CWE-125",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Hyperscan",
"versions": [
{
"version": "before version v5.4.2.1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40424.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40424",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-15T03:00:23.179Z",
"datePublished": "2026-11-10T17:44:49.036Z",
"dateUpdated": "2026-11-10T17:44:49.036Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:49.036Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Out-of-bounds Read",
"cweId": "CWE-125",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Hyperscan",
"versions": [
{
"version": "before version v5.4.2.1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40433.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40433",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-15T03:00:23.235Z",
"datePublished": "2026-11-10T17:44:54.870Z",
"dateUpdated": "2026-11-10T17:44:54.870Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:54.870Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Heap-based Buffer Overflow",
"cweId": "CWE-122",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) PROSet Wireless Wi-Fi Software for Windows",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow for some Intel(R) PROSet Wireless Wi-Fi Software for Windows within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40626.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40626",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-15T03:00:23.256Z",
"datePublished": "2026-11-10T17:44:57.838Z",
"dateUpdated": "2026-11-10T17:44:57.838Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:44:57.838Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Uncontrolled Search Path Element",
"cweId": "CWE-427",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Wireless Bluetooth(R) software for Windows",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) software for Windows within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40694.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40694",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-15T03:00:23.196Z",
"datePublished": "2026-11-10T17:45:02.220Z",
"dateUpdated": "2026-11-10T17:45:02.220Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:02.220Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Hyperscan",
"versions": [
{
"version": "before version v5.4.2.1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40695.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40695",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-05-15T03:00:15.528Z",
"datePublished": "2026-11-10T17:45:05.233Z",
"dateUpdated": "2026-11-10T17:45:05.233Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:05.233Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "NULL Pointer Dereference",
"cweId": "CWE-476",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Wireless Bluetooth(R)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Null pointer dereference for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/40xxx/CVE-2026-40697.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-40697",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-15T03:00:23.241Z",
"datePublished": "2026-11-10T17:45:08.304Z",
"dateUpdated": "2026-11-10T17:45:08.304Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:08.304Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Use After Free",
"cweId": "CWE-416",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Wireless Software for Windows",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free for some Intel(R) Wireless Software for Windows within Ring 3: User Applications may allow denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (low) and availability (low) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "LOW"
}
}
]
}
}
}
data/2026/41xxx/CVE-2026-41221.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-41221",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-18T03:00:24.881Z",
"datePublished": "2026-11-10T17:45:15.891Z",
"dateUpdated": "2026-11-10T17:45:15.891Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:15.891Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Integer Overflow or Wraparound",
"cweId": "CWE-190",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Slim Bootloader",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH"
}
}
]
}
}
}
data/2026/41xxx/CVE-2026-41224.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-41224",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-04-18T03:00:24.861Z",
"datePublished": "2026-11-10T17:45:18.958Z",
"dateUpdated": "2026-11-10T17:45:18.958Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:18.958Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Slim Bootloader",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. Startup code and smm adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH"
}
}
]
}
}
}
data/2026/42xxx/CVE-2026-42056.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-42056",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-05-15T03:00:15.480Z",
"datePublished": "2026-11-10T17:45:22.106Z",
"dateUpdated": "2026-11-10T17:45:22.106Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:22.106Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Stack-based Buffer Overflow",
"cweId": "CWE-121",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Wireless Bluetooth(R)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/42xxx/CVE-2026-42504.json
+2 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Go",
"dateReserved": "2026-04-28T00:21:12.792Z",
"datePublished": "2026-06-02T22:01:37.219Z",
"dateUpdated": "2026-11-10T11:21:19.746Z"
"dateUpdated": "2026-11-10T17:20:45.563Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go",
"dateUpdated": "2026-11-10T11:21:19.746Z"
"dateUpdated": "2026-11-10T17:20:45.563Z"
},
"title": "Quadratic complexity in WordDecoder.DecodeHeader in mime",
"descriptions": [
data/2026/42xxx/CVE-2026-42956.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-42956",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-05-27T03:00:16.598Z",
"datePublished": "2026-11-10T17:45:28.301Z",
"dateUpdated": "2026-11-10T17:45:28.301Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:28.301Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Wireless Bluetooth(R)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/44xxx/CVE-2026-44382.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-44382",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-05-15T03:00:15.427Z",
"datePublished": "2026-11-10T17:45:33.036Z",
"dateUpdated": "2026-11-10T17:45:33.036Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:33.036Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Out-of-bounds Read",
"cweId": "CWE-125",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Wireless Bluetooth(R)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/44xxx/CVE-2026-44606.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-44606",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-04T03:00:12.189Z",
"datePublished": "2026-11-10T17:45:36.326Z",
"dateUpdated": "2026-11-10T17:45:36.326Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:36.326Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Intelligent Storage Acceleration Library",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write for some Intel(R) Intelligent Storage Acceleration Library within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01514.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01514.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/44xxx/CVE-2026-44624.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-44624",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-23T03:00:05.195Z",
"datePublished": "2026-11-10T17:45:39.669Z",
"dateUpdated": "2026-11-10T17:45:39.669Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:39.669Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Incorrect Comparison",
"cweId": "CWE-697",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Slim Bootloader",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect comparison in the Ext2 parser for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/44xxx/CVE-2026-44625.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-44625",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-05-15T03:00:15.554Z",
"datePublished": "2026-11-10T17:45:43.003Z",
"dateUpdated": "2026-11-10T17:45:43.003Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:43.003Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Use After Free",
"cweId": "CWE-416",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Wireless Bluetooth(R)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/44xxx/CVE-2026-44685.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-44685",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-07-14T22:09:54.074Z",
"datePublished": "2026-11-10T17:45:48.332Z",
"dateUpdated": "2026-11-10T17:45:48.332Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:48.332Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Authentication Bypass by Spoofing",
"cweId": "CWE-290",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) TDX Migration Trust Domain (MigTD)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH"
}
}
]
}
}
}
data/2026/49xxx/CVE-2026-49036.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-49036",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-07-14T22:12:36.553Z",
"datePublished": "2026-11-10T17:45:55.790Z",
"dateUpdated": "2026-11-10T17:45:55.790Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:45:55.790Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"cweId": "CWE-367",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) TDX Migration Trust Domain (MigTD)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Time-of-check time-of-use race condition in the MigTD shared memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/50xxx/CVE-2026-50175.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-50175",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-23T03:00:05.174Z",
"datePublished": "2026-11-10T17:46:00.552Z",
"dateUpdated": "2026-11-10T17:46:00.552Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:46:00.552Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Untrusted Pointer Dereference",
"cweId": "CWE-822",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Slim Bootloader",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Untrusted pointer dereference in the FirmwareWakingVector for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/50xxx/CVE-2026-50249.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-50249",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-30T03:00:12.011Z",
"datePublished": "2026-11-10T17:46:05.887Z",
"dateUpdated": "2026-11-10T17:46:05.887Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:46:05.887Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Information Disclosure"
},
{
"lang": "en",
"description": "Out-of-bounds Read",
"cweId": "CWE-125",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read in the GenerationSetup for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an information disclosure. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/52xxx/CVE-2026-52899.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-52899",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-26T03:00:03.712Z",
"datePublished": "2026-11-10T17:46:09.330Z",
"dateUpdated": "2026-11-10T17:46:09.330Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:46:09.330Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Deserialization of Untrusted Data",
"cweId": "CWE-502",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "BigDL software",
"versions": [
{
"version": "before version 2.5.0b1",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of untrusted data for some BigDL software before version 2.5.0b1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01553.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01553.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/55xxx/CVE-2026-55709.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-55709",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-07-16T03:00:02.857Z",
"datePublished": "2026-11-10T17:46:12.985Z",
"dateUpdated": "2026-11-10T17:46:12.985Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:46:12.985Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Denial of Service"
},
{
"lang": "en",
"description": "Loop with Unreachable Exit Condition ('Infinite Loop')",
"cweId": "CWE-835",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) TDX Migration Trust Domain (MigTD)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Loop with unreachable exit condition ('infinite loop') in the MigTD's GetQuote for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/55xxx/CVE-2026-55716.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-55716",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-30T03:00:12.008Z",
"datePublished": "2026-11-10T17:46:16.549Z",
"dateUpdated": "2026-11-10T17:46:16.549Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:46:16.549Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Information Disclosure"
},
{
"lang": "en",
"description": "Out-of-bounds Read",
"cweId": "CWE-125",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds read in the CheckUefiVgaMode for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an information disclosure. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/56xxx/CVE-2026-56432.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-56432",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-07-14T22:12:36.536Z",
"datePublished": "2026-11-10T17:46:20.132Z",
"dateUpdated": "2026-11-10T17:46:20.132Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:46:20.132Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Unintended Proxy or Intermediary ('Confused Deputy')",
"cweId": "CWE-441",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) TDX Migration Trust Domain (MigTD)",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Unintended proxy or intermediary ('confused deputy') in the MigTD signing for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE"
}
}
]
}
}
}
data/2026/56xxx/CVE-2026-56435.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-56435",
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"state": "PUBLISHED",
"assignerShortName": "intel",
"dateReserved": "2026-06-30T03:00:12.021Z",
"datePublished": "2026-11-10T17:46:23.837Z",
"dateUpdated": "2026-11-10T17:46:23.837Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel",
"dateUpdated": "2026-11-10T17:46:23.837Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Escalation of Privilege"
},
{
"lang": "en",
"description": "Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP",
"versions": [
{
"version": "See references",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."
}
],
"references": [
{
"name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH"
}
}
]
}
}
}

Some files were not shown because too many files have changed in this diff Show More